Welp, sorry to drop this on a friday night ig.
Anyway, WHAT IS Eris? its a VERY reliable lpe that abuses the fax service provider to get a system shell on an active user session.
How did we attain that? well, we first bypass uac via silent cleanup (i know i know, extraordinarily creative) and then we run a script that basically sets up a new virtual fax device provider in the registry, reconfigures the fax service to run as local system, and then restarts the service to trigger the payload. the initial uac bypass is basically just a sacrifice
Firstly, you need g++ (minGW-w64) installed, or msys2
Compile the payload and the launcher:
g++ faxp.cpp -shared -o faxp.dll "-Wl,-s,-O2,--kill-at" -lwtsapi32 -luserenv; g++ eris.cpp -o eris.exe -luser32 -lshell32 -ladvapi32 -s -O2then just run the exe, boom give it a second and you have a elevated shell or, alternatively just run the precompiled binaries we included in releases, also works, but only if youre lazy.
Proof:
